Ensure Appropriate Permissions Are Enabled for System Wide Applications

CaoCấp 1Tự độngmacos

Mô tả

Applications in the System Applications Directory (/Applications) should be world- executable since that is their reason to be on the system. They should not be world- writable and allow any process or user to alter them for other processes or users to then execute modified versions. Some application vendors use a world-writable folder for their applications. This is against the standard practice on POSIX systems. If your organization is using an application that does not follow standard practices, you can add the application to the exclusion list in the audit and remediation (ie. the way Xcode is excluded with the grep -v Xcode.app command). It is also recommended that you alert the vendor that their application should be updated to follow security best practices. Unauthorized modifications of applications could lead to the execution of malicious code.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

[ -d /System/Volumes/Data/Applications ] || exit 1
/usr/bin/find /System/Volumes/Data/Applications -iname "*.app" -type d -perm -2 -ls 2>/dev/null | /usr/bin/grep -v Xcode.app | /usr/bin/wc -l | /usr/bin/xargs

Đầu ra mong đợi: 0

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Terminal Method: Run the following command to change the permissions for each application that does not meet the requirements: % IFS=$'\n' for apps in $( /usr/bin/sudo /usr/bin/find /System/Volumes/Data/Applications -iname "*\.app" -type d -perm -2 | grep -v Xcode.app ); do /usr/bin/sudo /bin/chmod -R o-w "$apps" done Note: Global changes should not be performed where mission-critical applications are part of the improperly permissioned applications.

Thuộc tính

Hệ điều hành: macos-14
Thẻ: access-controlmacossonoma
Tham chiếu: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 5.1.5 Ensure Appropriate Permissions Are Enabled for System Wide Applications

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target macos